Ad biz promises users control while bug could expose voice prompts.
Meta made much of the security of its AI assistant app Muse at launch earlier this month, calling out the app's reliance on Muse Secure VM.
"Each person stays in control of their Muse and decides how much access it gets," the ad biz declared, echoing earlier expansive claims about the privacy of its data gathering business.
Security researcher Patrick Wardle, founder of nonprofit Objective-See, has devised a proof-of-concept called not-a-mused for what he describes as a local zero-day in the Muse macOS app that allows an unprivileged local process to redirect Muse's dictation traffic and potentially abuse access granted to the app.
Muse, he explains in the project repo, has an undocumented setting called endo_voyager_dictation_endpoint that an attacker running code locally can change without special privileges to redirect dictation traffic to an attacker-controlled endpoint, potentially exposing dictated audio and prompts sent to the backend AI model. The flaw could enable prompt injection, the theft of authentication material, and abuse of whatever access the user has granted to Muse.
The vulnerability is not an issue for a remote attacker.
In a phone interview with The Register, Wardle likened the situation to living in an apartment building.
Apple, said Wardle, has done a good job with its Transparency, Consent, and Control framework and with privilege separation.
Wardle added that Apple provides on-device local dictation and if Meta chose to use that API, this vulnerability would not exist.